Post Syndicated from jzb original https://lwn.net/Articles/1063990/

Security updates have been issued by AlmaLinux (capstone, glibc, grub2, kernel, libarchive, libpng, mysql, and python3.11), Debian (evolution-data-server, imagemagick, and snapd), Fedora (bpfman, chromium, cpp-httplib, dotnet10.0, openssh, polkit, and vim), Mageia (graphicsmagick, imagemagick, openssh, and perl-YAML-Syck), Oracle (capstone, grub2, kernel, mysql, and python-pyasn1), Red Hat (container-tools:rhel8, rhc, yggdrasil, and yggdrasil-worker-package-manager), SUSE (cargo1.92, cargo1.93, chromedriver, coturn, curl, freerdp, jq, kernel, libssh, php-composer2, python311-uv, python312, qemu, tomcat, util-linux, vim, and virtiofsd), and Ubuntu (exiv2, freerdp3, glance, linux, linux-aws, linux-aws-hwe, linux-gcp, linux-gcp-4.15, linux-hwe, linux-kvm, linux-oracle, and linux-aws-fips, linux-fips, linux-gcp-fips).

Post Syndicated from jzb original https://lwn.net/Articles/1063723/

Greg Kroah-Hartman has announced the release of the 6.19.9 and 6.18.19 stable kernels. As usual, each
has important fixes throughout the tree; users are advised to
upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1063712/

Version
1.7.0 (“Daffodil”) of the Radicle peer-to-peer, local-first code
collaboration stack has been released. Some of the changes in this
release include improved I/O usage, the ability to block nodes at the
connection level, and clearer errors for rad id
updates. See the release notes for a full list of changes and bug
fixes.

Post Syndicated from jzb original https://lwn.net/Articles/1063659/

Security updates have been issued by Debian (freetype), Fedora (aqualung, kiss-fft, libtasn1, mac, and vim), Red Hat (libarchive, osbuild-composer, and rhc), Slackware (expat), SUSE (ca-certificates-mozilla, chromium, cockpit, cockpit-machines, cockpit-podman, curl, docker, docker-compose, docker-stable, gnutls, gstreamer-rtsp-server, gstreamer-plugins-ugly, gstreamer- plugins-rs, gstreamer-plugins-libav, gstreamer-plugins-good, gstreamer-plugins- base, gstreamer-plugins-bad, gstreamer-docs, gstreamer-devtools, gstreamer, gvfs, helm, kernel, krb5-appl, libsoup, libxslt, libxml2, openssh, python-cryptography, python-django, python-pypdf2, python-simpleeval, python311, qemu, ruby4.0-rubygem-sprockets, ruby4.0-rubygem-thor, ruby4.0-rubygem-web-console, ruby4.0-rubygem-websocket-extensions, skaffold, smb4k, tomcat, ucode-intel, util-linux, virtiofsd, and zlib), and Ubuntu (bouncycastle, exiv2, freerdp3, linux-aws, linux-aws-5.4, linux-gcp-5.4, linux-oracle, linux-oracle-5.4, linux-xilinx-zynqmp, linux-aws-fips, python2.7, roundcube, and valkey).

Post Syndicated from jzb original https://lwn.net/Articles/1062571/

Inside this week’s LWN.net Weekly Edition:

• Front: Privacy battles; page-cache-timing protections; null filesystems; Fedora Sandbox; safer kmalloc(); BPF in io_uring.
• Briefs: AppArmor vulnerabilities; snapd vulnerability; Sashiko; DPL election; Fedora Asahi 43; GIMP 3.2; Marknote 1.5; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.

Post Syndicated from jzb original https://lwn.net/Articles/1063466/

GNOME 50 has been
released. Notable changes in this release include enhancements to the
Orca screen-reader application, interface and performance improvements
for GNOME’s file manager (Files), a “massive set of stability and
performance updates” for its display-handling technologies, and
much more. See also the “What’s new
for developers” article that covers changes of interest to GNOME
and GNOME application developers.

Post Syndicated from jzb original https://lwn.net/Articles/1063453/

Qualys has discovered
a local-privilege escalation (LPE) vulnerability affecting Ubuntu
Desktop 24.04 and later:

This flaw (CVE-2026-3888) allows an unprivileged local attacker to
escalate privileges to full root access through the interaction of two
standard system components: snap-confine and systemd-tmpfiles.

More details are available in the security
advisory. Canonical has published updated packages as well as instructions
for verifying if a system is vulnerable and how to upgrade if so.

Post Syndicated from jzb original https://lwn.net/Articles/1063451/

Fedora Asahi Remix 43 is
now available:

This release incorporates all the exciting improvements brought by
Fedora
Linux 43. Notably, package management is significantly
upgraded with RPM 6.0 and the new
DNF5 backend for PackageKit for Plasma Discover and GNOME Software
ahead of Fedora Linux 44. It also continues to provide extensive
device support. This includes newly added support for the Mac Pro,
microphones in M2 Pro/Max MacBooks, and 120Hz refresh rate for
the built-in displays for MacBook Pro 14/16 models.

Post Syndicated from jzb original https://lwn.net/Articles/1063446/

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 9.0, compat-openssl11, container-tools:rhel8, grub2, and libvpx), Debian (ansible, gst-plugins-base1.0, and nodejs), Fedora (chromium, forgejo, and systemd), Oracle (container-tools:rhel8, grub2, kernel, libpng, libvpx, nginx, opencryptoki, python3.12, and vim), Red Hat (firefox, python-wheel, python3.12-wheel, and thunderbird), SUSE (389-ds, chromium, clamav, container-suseconnect, curl, freerdp, gvfs, kea, kubernetes, ruby4.0-rubygem-minitar, ruby4.0-rubygem-multi_xml, ruby4.0-rubygem-nokogiri, ruby4.0-rubygem-puma, ruby4.0-rubygem-rack, ruby4.0-rubygem-rack-session, ruby4.0-rubygem-rails, ruby4.0-rubygem-rails-html-sanitizer, ruby4.0-rubygem-railties, ruby4.0-rubygem-rubyzip, vim, and xen), and Ubuntu (flask, libssh, linux-aws-5.15, linux-gcp-5.15, linux-gke, linux-hwe-5.15,
linux-intel-iotg-5.15, linux-lowlatency-hwe-5.15, linux-oracle-5.15, linux-gcp-6.17, linux-realtime, linux-realtime, linux-realtime, linux-realtime-6.8, snapd, and vim).

Post Syndicated from jzb original https://lwn.net/Articles/1063287/

The Free Software Foundation Europe (FSFE) is reporting
that payment provider Nexi has terminated its contract without prior
notice, which means that a number of FSFE supporters’ recurring
payments have been halted:

Over the past few months, our former payment provider Nexi
S.p.A. (“Nexi”) requested access to private data, which we understood
to be specifically the usernames and passwords of our supporters. We
have refused this request. All our attempts to clarify Nexi’s request,
or to understand how their need for such information was necessary and
legal, were met with what we consider to be vague and unsatisfactory
explanations relating to a general need for risk analysis.

[…] The decisions that Nexi has made are incomprehensible to
us. Over the last months, as part of a security audit that Nexi
claimed to be conducting, we have provided them with large amounts of
the FSFE’s financial documentation, which even included private
information of our executive staff. We have answered all of their
questions. But we have to draw a line when private companies like Nexi
demand access to the sensitive and private data of our supporters.

According to the blog post, more than 450 supporters have been
affected by this. The FSFE’s donation pages have been updated with its
new payment provider.

Post Syndicated from jzb original https://lwn.net/Articles/1062579/

Fedora Project Leader (FPL) Jef Spaleta has issued
a “modest proposal” for a technology-innovation-lifecycle process
that would provide more formal structure for adopting technologies in
Fedora. The idea is to spur innovation in the project without having an adverse
impact on stability or the release process. Spaleta’s proposal is
somewhat light on details, particularly as far as specific examples of
which projects would benefit; however, the reception so far is mostly
positive and some think that it could make Fedora more “competitive” by being the
place where open-source projects come to grow.

Post Syndicated from jzb original https://lwn.net/Articles/1063248/

Security updates have been issued by Fedora (mingw-openexr, vim, and yarnpkg), Oracle (freerdp), Red Hat (389-ds-base, container-tools:rhel8, libpng, libpng15, nginx, nginx:1.24, nginx:1.26, opencryptoki, python3, python3.11, python3.12, and python3.9), SUSE (ruby4.0-rubygem-activestorage, ruby4.0-rubygem-activesupport, ruby4.0-rubygem-glogalid, ruby4.0-rubygem-grpc, ruby4.0-rubygem-jquery-rails, ruby4.0-rubygem-loofah, and rubygem4.0-rubygem-fluentd), and Ubuntu (curl, linux, linux-aws, linux-aws-6.17, linux-gcp, linux-hwe-6.17, linux-oracle,
linux-oracle-6.17, linux, linux-aws, linux-gcp, linux-gcp-6.8, linux-gke, linux-gkeop,
linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-lowlatency,
linux-lowlatency-hwe-6.8, linux-oracle, linux-oracle-6.8, linux, linux-aws, linux-gcp, linux-gkeop, linux-ibm, linux-ibm-5.15,
linux-intel-iotg, linux-kvm, linux-lowlatency, linux-nvidia,
linux-nvidia-tegra, linux-nvidia-tegra-5.15, linux-oracle,
linux-xilinx-zynqmp, linux-fips, linux-aws-fips, linux-gcp-fips, linux-gcp, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, python-cryptography, and roundcube).

Post Syndicated from jzb original https://lwn.net/Articles/1063122/

Version
1.5 of Marknote, a
Markdown-based note-management application, has been released. Notable
features in this release include Source Mode for working directly with
Markdown instead of the WYSIWYG interface, internal wiki-style links
for notes, as well as simpler management of notes and notebooks.

Post Syndicated from jzb original https://lwn.net/Articles/1063115/

Kurt Roeckx has announced
that Debian has moved to the campaigning period for the 2026 Debian
Project Leader (DPL) election. This year there is only one candidate,
Sruthi Chandran, so Debian voters will have a choice between Chandran
as DPL or “None of the above”. The campaign period will run through
April 3, and the voting period will run from April 4 to
April 17. Chandran has not yet posted a platform for the 2026
election, but her 2024
platform is available on the Debian wiki.

Post Syndicated from jzb original https://lwn.net/Articles/1063095/

Security updates have been issued by AlmaLinux (.NET 10.0, .NET 8.0, .NET 9.0, delve, git-lfs, gnutls, kernel, mingw-libpng, nfs-utils, opentelemetry-collector, python3.11, python3.12, python3.9, and vim), Debian (chromium, gimp, kernel, linux-6.1, and wireless-regdb), Fedora (alertmanager, chromium, freerdp, glab, golang-github-openprinting-ipp-usb, gst-devtools, gst-editing-services, gstreamer1, gstreamer1-doc, gstreamer1-plugin-libav, gstreamer1-plugins-bad-free, gstreamer1-plugins-base, gstreamer1-plugins-good, gstreamer1-plugins-ugly-free, gstreamer1-rtsp-server, insight, pcs, pgadmin4, python-gstreamer1, python3.10, python3.11, python3.6, qgis, SDL2_sound, SDL3_sound, systemd, and wireshark), Mageia (python-nltk, tomcat, and vim), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, compat-openssl11, dtrace, python3.12, and vim), Red Hat (buildah, git-lfs, golang-github-openprinting-ipp-usb, opentelemetry-collector, podman, and runc), and SUSE (amazon-ssm-agent, busybox, clamav, firefox, giflib-devel-32bit, glibc, heroic-games-launcher, himmelblau, kubelogin, libpng15, libsoup, libsoup2, mingw32-binutils, mingw64-binutils, osc, obs-scm-bridge, python, python-black, python3, qemu, ruby4.0-rubygem-actioncable, ruby4.0-rubygem-actiontext, ruby4.0-rubygem-activejob, ruby4.0-rubygem-activemodel, tomcat, and tomcat10).

Post Syndicated from jzb original https://lwn.net/Articles/1062862/

Greg Kroah-Hartman has announced the release of the 6.19.8, 6.18.18, and 6.12.77 stable kernels. Each of these
kernels includes a number of important fixes; users are advised to
upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1062775/

Security updates have been issued by Debian (chromium, kernel, and multipart), Fedora (dnf5, dr_libs, easyrpg-player, libmaxminddb, python3.12, strongswan, task, and udisks2), Oracle (.NET 10.0, .NET 8.0, .NET 9.0, gnutls, ImageMagick, kernel, libvpx, mingw-libpng, nginx:1.26, python3.11, and uek-kernel), Red Hat (delve, git-lfs, mingw-libpng, osbuild-composer, and rhc-worker-playbook), SUSE (cjson, curl, dnsdist, libsoup2, postgresql16, postgresql17, postgresql18, python-lxml_html_clean, python-pypdf2, python36, and thunderbird), and Ubuntu (dotnet8, dotnet9, dotnet10, freetype, golang-github-go-git-go-git, golang-golang-x-net, openssh, python-cryptography, sudo, and util-linux).

Post Syndicated from jzb original https://lwn.net/Articles/1062575/

Sasha Levin has announced the release of the 6.19.7 and 6.18.17 stable kernels. As usual, each
contains important fixes throughout the tree; users are advised to
upgrade.

Post Syndicated from jzb original https://lwn.net/Articles/1062570/

Security updates have been issued by AlmaLinux (gimp, git-lfs, grafana-pcp, kernel, mysql8.4, nfs-utils, opentelemetry-collector, osbuild-composer, postgresql:16, and python3.12), Debian (imagemagick and netty), Fedora (dr_libs and python-lxml-html-clean), Slackware (libarchive and libxml2), SUSE (busybox, coredns, firefox, freerdp, ghostty, gnutls, go1.25, go1.26, GraphicsMagick, grype, helm, helm3, ImageMagick, perl-Compress-Raw-Zlib, python, python311-lxml_html_clean, python311-PyPDF2, tomcat11, and traefik), and Ubuntu (curl, gimp, and libpng).

Post Syndicated from jzb original https://lwn.net/Articles/1061465/

Inside this week’s LWN.net Weekly Edition:

• Front: Chardet; Linux and age verification; Debian AI; Python lazy imports; Python type-system PEP; PQC HTTPS certificates; MGLRU; Fedora strategy.
• Briefs: LLM vulnerability; NTP security; OpenWrt 25.12.0; SUSE sale; Buildroot 2026.02; digiKam 9.0.0; Rust 1.94.0; Quotes; …
• Announcements: Newsletters, conferences, security updates, patches, and more.